Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-36977: matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.

CVE-2021-36977 · published 5 years ago

Summary

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
matio_project	matio	1.5.20 1.5.21 `cpe:2.3:a:matio_project:matio:1.5.20:::::::*`

Original advisory text

matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry), related to use of HDF5 1.12.0.

References

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265 Patch Third Party Advisory
https://github.com/HDFGroup/hdf5/issues/272 Issue Tracking Third Party Advisory
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/matio/OSV-2021-440.yaml Third Party Advisory
https://github.com/google/oss-fuzz-vulns/commit/37b781ace1b4228fc36483bb7e30c72e... Issue Tracking Patch Third Party Advisory
https://github.com/google/oss-fuzz/issues/4999 Issue Tracking Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published20 Jul 2021

Updated31 Oct 2026

First seen29 Sep 2026

Sources

CVE-2021-36977 · NVD

Track software like this

Free during beta